Skip to content

Content Security Policy should dynamically support EKS without requiring manual configuration of the CSP

The current docs on adding EKS clusters make no mention of amending the gitlab_rails['content_security_policy'] for Omnibus installations.

If this value is left at the default configuration (EDIT: the default was changed, but this would be a problem with the configuration recommended in the documentation as well) then no details will load for the available roles/VPCs/etc. due to the default CSP settings:

Refused to connect to 'https://iam.amazonaws.com/' because it violates the following Content Security Policy directive: "connect-src 'self'".

In order to allow connections to AWS the following must be added to gitlab.rb:

gitlab_rails['content_security_policy'] = {
  'directives' => {
    'connect_src' => "'self' '.amazonaws.com'",
  }
}
Edited by Dominic Couture